June 2021 - Arch-security - lists.archlinux.org

[ASA-202106-27] isync: arbitrary code execution
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-27 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-3578 Package : isync Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2042 Summary ======= The package isync before version 1.4.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.4.2-1. # pacman -Syu "isync>=1.4.2-1" The problem has been fixed upstream in version 1.4.2. Workaround ========== None. Description =========== A security issue was found in mbsync before version 1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client. Impact ====== A remote server could cause arbitrary code execution on the mbsync client using a crafted APPENDUID response. References ========== https://sourceforge.net/p/isync/mailman/message/37297759/ https://sourceforge.net/p/isync/isync/ci/589d2ed4283130108df5495b5510d82228… https://security.archlinux.org/CVE-2021-3578

1 0

[ASA-202106-26] python-websockets: private key recovery
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-26 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-33880 Package : python-websockets Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-2040 Summary ======= The package python-websockets before version 9.1-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 9.1-1. # pacman -Syu "python-websockets>=9.1-1" The problem has been fixed upstream in version 9.1. Workaround ========== None. Description =========== The aaugustin websockets library before 9.1 for Python has an observable timing discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack. Impact ====== A remote attacker could guess HTTP Basic Authentication passwords using a timing attack. References ========== https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7… https://security.archlinux.org/CVE-2021-33880

1 0

[ASA-202106-25] python-urllib3: denial of service
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-25 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-33503 Package : python-urllib3 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2038 Summary ======= The package python-urllib3 before version 1.26.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.26.5-1. # pacman -Syu "python-urllib3>=1.26.5-1" The problem has been fixed upstream in version 1.26.5. Workaround ========== None. Description =========== A security issue has been found in python-urllib3 before version 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL was passed as a parameter or redirected to via an HTTP redirect. Impact ====== A remote attacker could exhaust CPU resources, leading to denial of service, using a crafted URL. References ========== https://github.com/urllib3/urllib3/security/advisories/GHSA-q2q7-5pp4-w6pg https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759… https://security.archlinux.org/CVE-2021-33503

1 0

[ASA-202106-24] polkit: privilege escalation
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-24 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-3560 Package : polkit Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-2028 Summary ======= The package polkit before version 0.119-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 0.119-1. # pacman -Syu "polkit>=0.119-1" The problem has been fixed upstream in version 0.119. Workaround ========== None. Description =========== A security issue was found in polkit before version 0.119. When a requesting process disconnects from dbus-daemon just before the call to polkit_system_bus_name_get_creds_sync starts, the process cannot get a unique uid and pid of the process and it cannot verify the privileges of the requesting process. Impact ====== A local attacker could escalate privileges by exploiting a race condition. References ========== https://www.openwall.com/lists/oss-security/2021/06/03/1 https://bugzilla.redhat.com/show_bug.cgi?id=1961710 https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-wi… https://gitlab.freedesktop.org/polkit/polkit/-/commit/a04d13affe0fa53ff618e… https://security.archlinux.org/CVE-2021-3560

1 0

[ASA-202106-23] apache: denial of service
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-23 ========================================== Severity: High Date : 2021-06-09 CVE-ID : CVE-2021-31618 Package : apache Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2041 Summary ======= The package apache before version 2.4.48-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.4.48-1. # pacman -Syu "apache>=2.4.48-1" The problem has been fixed upstream in version 2.4.48. Workaround ========== None. Description =========== A security issue has been found in the Apache HTTP Server (httpd) before version 2.4.48. The Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions, an HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a footer. This led to a NULL pointer dereference on initialised memory, reliably crashing the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited for denial of service (DoS) of the server. Impact ====== A remote attacker could crash the HTTP server using a crafted HTTP/2 request. References ========== https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-31618 https://svn.apache.org/viewvc?view=revision&revision=1889759 https://security.archlinux.org/CVE-2021-31618

1 0

[ASA-202106-22] thunderbird: arbitrary code execution
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-22 ========================================== Severity: High Date : 2021-06-09 CVE-ID : CVE-2021-29967 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2035 Summary ======= The package thunderbird before version 78.11.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 78.11.0-1. # pacman -Syu "thunderbird>=78.11.0-1" The problem has been fixed upstream in version 78.11.0. Workaround ========== None. Description =========== Mozilla developers reported memory safety bugs present in Firefox 88 and Thunderbird 78.10. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker could execute arbitrary code using a crafted email message. References ========== https://www.mozilla.org/security/advisories/mfsa2021-23/ https://www.mozilla.org/security/advisories/mfsa2021-26/ https://bugzilla.mozilla.org/buglist.cgi?bug_id=1602862%2C1703191%2C1703760… https://security.archlinux.org/CVE-2021-29967

1 0

[ASA-202106-21] gitlab: multiple issues
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-21 ========================================== Severity: High Date : 2021-06-09 CVE-ID : CVE-2021-22181 CVE-2021-22213 CVE-2021-22214 CVE-2021-22216 CVE-2021-22217 CVE-2021-22218 CVE-2021-22219 CVE-2021-22220 CVE-2021-22221 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2023 Summary ======= The package gitlab before version 13.12.2-1 is vulnerable to multiple issues including denial of service, information disclosure, access restriction bypass, authentication bypass, cross-site scripting and content spoofing. Resolution ========== Upgrade to 13.12.2-1. # pacman -Syu "gitlab>=13.12.2-1" The problems have been fixed upstream in version 13.12.2. Workaround ========== None. Description =========== - CVE-2021-22181 (denial of service) A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 before 13.12.2 allows an attacker to create a recursive pipeline relationship and exhaust resources. - CVE-2021-22213 (information disclosure) A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 before 13.12.2 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari. - CVE-2021-22214 (access restriction bypass) When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 before 13.12.2 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited. - CVE-2021-22216 (denial of service) A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2 allows an attacker to cause uncontrolled resource consumption with a very long issue or merge request description. - CVE-2021-22217 (denial of service) A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request. - CVE-2021-22218 (content spoofing) All versions of GitLab CE/EE starting with 12.8 before 13.12.2 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits. - CVE-2021-22219 (information disclosure) GitLab CE/EE since version 9.5 before 13.12.2 allows a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking. - CVE-2021-22220 (cross-site scripting) An issue has been discovered in GitLab affecting all versions starting with 13.10 before 13.12.2. GitLab was vulnerable to a stored cross-site scripting (XSS) attack in the blob viewer of notebooks. - CVE-2021-22221 (authentication bypass) An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.12.2. Insufficient expired password validation in various operations allowed users to maintain limited access after their password expired. Impact ====== A remote attacker could disclose sensitive information, bypass authentication, execute JavaScript code using cross-site scripting, spoof content or crash the GitLab server. References ========== https://about.gitlab.com/releases/2021/06/01/security-release-gitlab-13-12-… https://gitlab.com/gitlab-org/gitlab/-/issues/300308 https://hackerone.com/reports/1089277 https://gitlab.com/gitlab-org/gitlab/-/issues/322926 https://hackerone.com/reports/1110131 https://gitlab.com/gitlab-org/gitlab/-/issues/329890 https://gitlab.com/gitlab-org/gitlab/-/issues/300709 https://hackerone.com/reports/1090049 https://gitlab.com/gitlab-org/gitlab/-/issues/297665 https://hackerone.com/reports/1077019 https://gitlab.com/gitlab-org/gitlab/-/issues/296995 https://gitlab.com/gitlab-org/gitlab/-/issues/294128 https://hackerone.com/reports/1060114 https://gitlab.com/gitlab-org/gitlab/-/issues/292006 https://security.archlinux.org/CVE-2021-22181 https://security.archlinux.org/CVE-2021-22213 https://security.archlinux.org/CVE-2021-22214 https://security.archlinux.org/CVE-2021-22216 https://security.archlinux.org/CVE-2021-22217 https://security.archlinux.org/CVE-2021-22218 https://security.archlinux.org/CVE-2021-22219 https://security.archlinux.org/CVE-2021-22220 https://security.archlinux.org/CVE-2021-22221

1 0

[ASA-202106-20] inetutils: arbitrary code execution
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-20 ========================================== Severity: High Date : 2021-06-09 CVE-ID : CVE-2019-0053 CVE-2020-10188 Package : inetutils Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1003 Summary ======= The package inetutils before version 2.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.0-1. # pacman -Syu "inetutils>=2.0-1" The problems have been fixed upstream in version 2.0. Workaround ========== None. Description =========== - CVE-2019-0053 (arbitrary code execution) inetutils before version 1.9.4.90 contains a stack overflow vulnerability in the client-side environment variable handling which can be exploited to escape restricted shells on embedded devices. A stack-based overflow is present in the handling of environment variables when connecting telnet.c to remote telnet servers through oversized DISPLAY arguments. - CVE-2020-10188 (arbitrary code execution) A vulnerability was found in inetutils before version 1.9.4.91 where incorrect bounds checks in the telnet server’s (telnetd) handling of short writes and urgent data could lead to information disclosure and corruption of heap data. An unauthenticated remote attacker could exploit these bugs by sending specially crafted telnet packets to achieve arbitrary code execution in the telnet server. Impact ====== Requesting environment variables with crafted contents could lead to arbitrary code execution in a telnet client. Additionally an unauthenticated remote attacker could execute arbitrary code on a telnet server via crafted packets. References ========== https://bugs.archlinux.org/task/70040 https://raw.githubusercontent.com/hackerhouse-opensource/exploits/master/in… https://git.savannah.gnu.org/gitweb/?p=inetutils.git;a=commitdiff;h=1480573… https://git.savannah.gnu.org/gitweb/?p=inetutils.git;a=commitdiff;h=07fdb42… https://bugzilla.redhat.com/show_bug.cgi?id=1811673 https://git.savannah.gnu.org/gitweb/?p=inetutils.git;a=commitdiff;h=cd7e7e6… https://security.archlinux.org/CVE-2019-0053 https://security.archlinux.org/CVE-2020-10188

1 0

[ASA-202106-19] keycloak: incorrect calculation
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-19 ========================================== Severity: Low Date : 2021-06-01 CVE-ID : CVE-2021-3461 Package : keycloak Type : incorrect calculation Remote : Yes Link : https://security.archlinux.org/AVG-1994 Summary ======= The package keycloak before version 13.0.1-1 is vulnerable to incorrect calculation. Resolution ========== Upgrade to 13.0.1-1. # pacman -Syu "keycloak>=13.0.1-1" The problem has been fixed upstream in version 13.0.1. Workaround ========== None. Description =========== Keycloak may fail to logout a user session if the logout request comes from an external SAML identity provider that is set up to identify the principal via attributes rather than by Subject Name ID. Impact ====== A remote attacker could take over a logged out user session if they manage to obtain the old session token. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1941565 https://issues.redhat.com/browse/KEYCLOAK-17495 https://github.com/keycloak/keycloak/commit/f014299e7c781dff2b492b81bc81adc… https://security.archlinux.org/CVE-2021-3461

1 0

[ASA-202106-18] packagekit: information disclosure
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-18 ========================================== Severity: Low Date : 2021-06-01 CVE-ID : CVE-2020-16121 Package : packagekit Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1260 Summary ======= The package packagekit before version 1.2.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.2.3-1. # pacman -Syu "packagekit>=1.2.3-1" The problem has been fixed upstream in version 1.2.3. Workaround ========== None. Description =========== The InstallFiles, GetFilesLocal and GetDetailsLocal methods of the DBus interface to PackageKit <= 1.1.13 access files before checking for authorization. This allows non-privileged users to learn the MIME type of any file on the system. Impact ====== A non-privileged local attacker could learn the MIME type of any file on the system. References ========== https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887 https://github.com/hughsie/PackageKit/commit/d5e8c59745bf7c521c6f311e6b22b4… https://security.archlinux.org/CVE-2020-16121

1 0